Data Protection & Freedom of Information Office

Subject Access Request

Under Data Protection law, an individual has the right to ask an organisation for access to and copies of any personal data held about them, whether in paper or IT systems. This procedure is called a Subject Access Request (SAR). In Data Protection terminology, the Data Subject is the individual about whom personal data may be held.

• An individual may only request information about themselves.
• Proof of identity from the individual is required (photographic ID such as a passport, drivers licence, student card etc.).
• A third-party, such as a lawyer, may submit a SAR on behalf of a client, subject to the written consent of the client.
• Data Protection law lays down a strict one month response timescale for SARs.

Submit a Subject Access Request using our webform